{
  "spec": "rs-witness-resilience/1",
  "quorum": {
    "confirmed_unaffiliated": 0,
    "required": 2,
    "source": "schedule",
    "schedule": [
      {
        "min_confirmed": 0,
        "required": 2
      },
      {
        "min_confirmed": 5,
        "required": 3
      },
      {
        "min_confirmed": 10,
        "required": 4
      },
      {
        "min_confirmed": 20,
        "required": 6
      },
      {
        "min_confirmed": 40,
        "required": 8
      }
    ],
    "next_step": {
      "at_confirmed": 5,
      "required": 3
    },
    "finalized_through": null,
    "anchor_confirmed_through": null,
    "rule": "The quorum steps up on a published schedule as confirmed-unaffiliated witnesses grow: 2 required while fewer than 5 are confirmed, 3 at 5, 4 at 10, 6 at 20, 8 at 40. Every tier's requirement sits well below the count that triggers it, so churn is weather, not a freeze; the requirement is recomputed from the live count on every read."
  },
  "witnesses": [
    {
      "label": "W-001",
      "key_fingerprint": "77b542fc",
      "affiliation": "affiliated",
      "current": true,
      "registered_at": "2026-11-07T00:31:30.651Z",
      "last_verified_at": "2026-11-07T01:42:03.214Z",
      "last_verified_age_seconds": 1567,
      "last_cosignature_at": "2026-11-07T02:06:33.402Z",
      "last_cosignature_age_seconds": 97,
      "cosignatures": 22,
      "health": "active",
      "last_probe": null
    }
  ],
  "aggregates": {
    "registered_keys": 1,
    "distinct_domains": 1,
    "confirmed_unaffiliated": 0,
    "active": 1,
    "quiet": 0,
    "stale": 0,
    "cosignatures_total": 22,
    "stalest_confirmed_cosignature_age_seconds": null,
    "probes_recorded": 0,
    "last_probe_at": null
  },
  "basis": "Health classes and ages are computed live from the witness registry's own records (key verifications and cosignatures). Probe outcomes are recorded only when an operator runs POST /v1/admin/witnesses/probe, which re-fetches each current key's published file through the same fetch path registration uses; a probe is observation, never adoption — it changes no registry row, no affiliation and no finality, and no probe daemon or scheduler runs on this deployment, so probe ages are published beside their outcomes.",
  "note": "A witness whose key was last verified more than 30 days ago reads stale and cannot cosign until it registers again. Witnesses are listed under neutral labels with short key fingerprints only — never a domain or a full key id."
}